Description

The new legacy hydration path inferTopLevelSchedule() copies top-level schedule-like fields into next.schedule and passes them through coerceSchedule(), but no minimum interval or frequency validation is enforced.

This makes it possible for attacker-controlled or corrupted stored job rows using legacy flat fields (e.g., everyMs: 0, everyMs: 1, or high-frequency cron expressions) to be normalized into an active schedule and then executed extremely frequently, potentially causing CPU exhaustion / tight execution loops.

Key points:

• inferTopLevelSchedule() blindly copies at/atMs/everyMs/anchorMs/expr/cron/tz/staggerMs from the raw object when present.
• coerceSchedule() normalizes fields and deduces kind, but does not enforce sane lower bounds for everyMs or validate cron frequency.
• Downstream scheduling clamps everyMs to a minimum of 1ms (e.g., Math.max(1, ...)), which is still effectively an abusive schedule.

Vulnerable code:

for (const field of ["at", "atMs", "everyMs", "anchorMs", "expr", "cron", "tz", "staggerMs"]) {
  if (field in next) {
    schedule[field] = next[field];
  }
}
...
next.schedule = inferredSchedule;

If cron job definitions can be influenced by untrusted users (API input) or by tampering with persisted job specs (store), this can be used to trigger resource exhaustion by creating jobs that are due continuously.

Recommendation

Enforce schedule safety constraints during normalization (and ideally also at persistence boundaries):

• Reject or clamp everyMs below a safe minimum (commonly >= 1000ms or a configurable minimum).
• Validate cron expressions and reject schedules that would run more frequently than the minimum allowed cadence.
• Consider rejecting ambiguous combinations even when kind is specified (e.g., kind:"cron" but everyMs also present).

Example (enforce a minimum interval in coerceSchedule() for every):

const MIN_EVERY_MS = 1000;
...
if (next.kind === "every") {
  const everyMsRaw = coerceFiniteScheduleNumber(schedule.everyMs);
  if (everyMsRaw === undefined || everyMsRaw < MIN_EVERY_MS) {
    throw new Error(`invalid everyMs: must be >= ${MIN_EVERY_MS}`);
  }
  next.everyMs = Math.floor(everyMsRaw);
}

And for cron, compute the next two run times and enforce that the delta is >= the minimum cadence, rejecting expressions that violate the policy.